Note:
If it's set to 1 you'll get a warning message when saving a game. But this byte doesn't get set if you use a cheat enabler.

Display Settings

0xBA6784 - [dword] Brightness

0xBA6792 - [byte] Legend

0xBA676C - [byte] Radar Mode

0 = maps & blips

1 = blips

2 = off

0xBA6769 - [byte] Hud Mode

0 = off

1 = on

0xBA678C - [byte] Subtitles

0xBA6830 - [byte] Store gallery photos

0xBA6788 - [float] Draw Distance

0xBA6794 - [byte] Frame limiter

0xBA6793 - [byte] Widescreen

0xA9AE54 - [byte] Visual FX Quality

0xBA680C - [byte] Mip Mapping

0xBA6814 - [byte] Antialiasing values:

1 = 0x (off)

2 = 1x

3 = 2x

4 = 3x

0xBA6820 - [byte] Resolution values:

11 = 640x480

12 = 800x400

13 = 800x600

15 = 1024x768

(Depends on the graphic driver/hardware.)

Sound Configuration

0xBA6798 - [byte] Radio Volume [0 through 64]

0xBA6797 - [byte] SFX Volume [0 through 64]

0xBA6799 - [byte] Radio Equalizer

0xBA6795 - [byte] Radio Auto-tune

0xBA67F8 - [byte] Usertrack/Play mode values:

0 = radio

1 = random

0xBA680D - [byte] Usertrack/Automatic Media Scan

0xBA679A - [byte] Radio Station ID values:

1 to 12 (see below for station names according to ID)

1 = "Playback FM"

2 = "K Rose"

3 = "K-DST"

4 = "Bounce FM"

5 = "SF-UR"

6 = "Radio Los Santos"

7 = "Radio X"

8 = "CSR 103.9"

9 = "K-JAH West"

10 = "Master Sounds 98.3"

11 = "WCTR Talk Radio"

12 = "User Track Player"

13 = "Radio Off"

AlienX:
Seems that the Radio Station ID is just a menu identifier, this does not actually change the radio station while in-game!

Another note... The opcode for switching players radio stations does not work in line with the station ID's, i have yet to figure out what station ID's are for the SCM code - Dont try to use the above ID's for the SCM Operation Code, it just wont work

Thanks to AlienX For the station names and ID's

Controller Configuration

0xBA6818 - [byte] Controller Configuration values:

0 = mouse + keys

1 = joypad

0xB6EC1C - [float] Mouse sensitivity

0xC1CC02 - [byte] Steer with mouse

0xC1CC03 - [byte] Fly with mouse

0xB6EC2E - REAL aiming mode offset, not menu:

0 = joypad

1 = mouse + keys

Other Dynamic Memory Addresses (non-static)

Pedestrians

General

0xB6F5F0 - Player pointer (CPed)

0xB7CD98 - Player pointer, direct offset to the ped pool start (CPed)

0xB74498 - CPeds maximum number (normally 140)

0xB74490 - Contains a pointer to a main struct below

This struct:

+0 = Contains a pointer to the first element in the pool

+4 = Contains a pointer to a byte map indicating which elements are in use

+8 = [dword] Is the maximum number of elements in the pool

+12 = [dword] Is the current number of elements in the pool

Each ped object is 1988 (0x7C4) bytes.

For each ped in the pool:

In most cases, you can use even the dword of playeraddress as CPed value

CPed +0x14 = Pointer to XYZ position structure (and rotation)

(CPed+0x14) +0x0 to +0x2C = [dword] Is the rotation matrix

(CPed+0x14) +0x30 = [dword] XPos

(CPed+0x14) +0x34 = [dword] YPos

(CPed+0x14) +0x38 = [dword] ZPos

CPed +0x2F = [byte] Location status:

0 = outside

3 = inside a building

CPed +0x42 = [byte] Is the BP/EP/FP/DP (special flags) status of the player as follows:

Note: You can set the above values to 0 or 1 to give the car a bomb. Some other flags get set when you arm the bomb. So if you set this value to 4 or 5, or actually arm the bomb through normal gameplay, it does not help if you try to change this value back.

+1195 = [BYTE] The number of peds (usually cops) trying to hide behind this car.

+0x8A4 = [float] Nitro Count

1.0 Nitro filled (in case of number of NOS is equal to 0 it'll mean Empty)

-1.0 Nitro discharged

+0x48A = [BYTE] Number of available NOS in the vehicle

1~10 Have Available NOS

0 No Have Available NOS

+1200 = [float] Body dirt level:

0.0 = fully clean

15.0 = maximum dirt visible

+1216 = [float] Health/Car Damage Left:

<250.0 = on fire

1000.0 = undamaged

+1272 = [dword] Car Door Locked State:

1 = open

2 = locked

+1300 = [dword] Alternate siren (honking):

0 = off

1 = on

Note: Automatically gets reset back to 0. To prevent this just NOP 0x6E0A3B (6 bytes).

Note:
You cannot actually shoot the wheels of bmx. If you set the value 1 at above two offsets, it rides as if the wheels were shot. They probably not work.

+1736 = [byte] Is the bike identifier.

Note:
Gets set to 1 if this vehicle is a bike (or bmx).

+1824 = [float] Front-Left suspension height

+1828 = [float] Rear-Left suspension height

+1832 = [float] Front-Rear suspension height

+1836 = [float] Rear-Rear suspension height

Note: There is also a copy of the suspension values at -0x10, but these are 'smoother'. They range from 0 to 1 (1 = fully extended/airborne, 0 = fully compressed).

+2020 = [float] Front-Left suspension height

+2024 = [float] Rear-Left suspension height

+2028 = [float] Front-Right suspension height

+2032 = [float] Rear-Right suspension height

+2156 = [word] Current load of vehicle, works for vehicles such as dumper, packer, dozer, forklift and so on.

+2160 = [word] Last load value of vehicle. Used to detect whether vehicle should have sound of raising/lowering a load. After detecting it gets value of car struct +2156 below.

+2276 = [float] Burn Timer (in ms)

Let's say, the Car Position of this given car starts at 0xC5F5DB4:

+0 = X Level to the ground

+4 = Y Level to the ground

+8 = Z Level to the ground

+16 = X Where am I looking

+20 = Y Where am I looking

+24 = Z Where am I looking

+32 = Dyn flight data

+36 = Dyn flight data

+40 = Dyn flight data

+48 = CarPosX

+52 = CarPosY

+56 = CarPosZ

Following offsets are Floats, as positions of doors and other car parts that gets detached by damage. We need to recalculate and set their locations if we warp a car from one location to another. Otherwise the car spins uncontrollably:

+1828 = Detachables1 Pos X

+1832 = Detachables1 Pos Y

+1836 = Detachables1 Pos Z

+1872 = Detachables2 Pos X

+1876 = Detachables2 Pos Y

+1880 = Detachables2 Pos Z

+1916 = Detachables3 Pos X

+1920 = Detachables3 Pos Y

+1924 = Detachables3 Pos Z

+1960 = Detachables4 Pos X

+1964 = Detachables4 Pos Y

+1968 = Detachables4 Pos Z

The locations of the detachable objects are different for cars and bikes. This is merely because bike object is actually smaller than the car object. The car object is used for all vehicles (including heli) but the bikes.

Offsets for Detachables:

+1532 = BikeDetachPosAdr(0)

+1632 = BikeDetachPosAdr(1)

+1676 = BikeDetachPosAdr(2)

+1720 = BikeDetachPosAdr(3)

+1764 = BikeDetachPosAdr(4)

+1828 = CarDetachPosAdr(0)

+1872 = CarDetachPosAdr(1)

+1916 = CarDetachPosAdr(2)

+1960 = CarDetachPosAdr(3)

The trailer of the tanker is handled the same way as the vehicles. Its pointer gets set at offset:

+1224

To the car object start. When warping vehicles that has trailer, we need to warp this 'vehicle' as well.
The same pointer is used also when you are towing other vehicles as well.

0x8A6168 - "Master" jumptable, each dword points to one of 27 different functions, each one handling approx 100 opcodes

0x466C50 - Opcodes 0000 - 0063. Array of dword, each pointing to the function for that opcode

0x468364 - Opcodes 0064 - 00C4. Array of dword, each pointing to the function for that opcode

0x469E4C - Opcodes 00D6 - 0129. Array of byte, each byte is an index for the array of dword at 0x469DD4, which points to the opcode function

0x47D1B4 - Opcodes 0137 - 018F. Array of byte, each byte is an index for the array of dword at 0x47D0F4, which points to the opcode function

0x47DFE0 - Opcodes 0190 - 01F3. Array of byte, each byte is an index for the array of dword at 0x47DF58, which points to the opcode function

0x47F304 - Opcodes 01F4 - 0256. Array of byte, each byte is an index for the array of dword at 0x47F24C, which points to the opcode function

0x47FA04 - Opcodes 0292 - 02B8. Array of byte, each byte is an index for the array of dword at 0x47F9BC, which points to the opcode function

0x480FD8 - Opcodes 02BE - 031D. Array of byte, each byte is an index for the array of dword at 0x480F10, which points to the opcode function

0x4836B8 - Opcodes 0320 - 0382. Array of byte, each byte is an index for the array of dword at 0x483600, which points to the opcode function

(No time to finish now, will finish later)

Threads

0xA8B430 - Start of the threads pool. There are two queues: the active threads and inactive ones.
0xA8B42C - Pointer to the first active SCM thread.
0xA8B428 - Pointer to the first inactive SCM thread.

Misc

+4 = [dword] Time in ms passed from the moment a vehicle flipped. Used by opcode 018F

0xA90850 - Start of the mission cleanup list. This list keeps the handles of any entities created during a mission. When the opcode 00D8 executed (normally it happens at the end of any mission), the game reads this list and destroys everything being stored there. Maximum items on the list is 75. Each item has the following structure:

Weather Codes

The following values tie up with the sections in data/timecycp.dat. There are several different kinds of weathers (including underwater), and the current weather affects viewing distance, sky colour, fog intensity, and other things like that. The appearance of each weather is time-dependent too.